All Saints RC School City of York Council Internal Audit Report 2016/17

Business Unit: Children’s Services, Education & Skills, Headteacher: W Scriven Date Issued: 16/02/17 Status: Final Reference: 15692/001

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Wednesday 16th November and Thursday 17th November 2016 as part of the Internal Audit plan for Education, Skills and Children's Services for 2016/17.

Objectives and Scope of the Audit The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority's Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise. The audit covered the following areas in accordance with the specification issued on 6th October 2016:

- Governance;
- Financial Management;
- System Reconciliation;
- Petty Cash
- Contracts – Ordering, Purchasing and Authorisation;
- Income;
- Capital and Property;
- Additional School Activity Provision;
- Human Resources;
- Payroll;
- School Meals;
- Pupil Numbers;
- Voluntary Funds Monitoring Arrangements;
- Data Protection and Information Technology;
- Insurance and Risk Management;
- Joint Use Facilities;
- Inventory Records;
- Minibus;
- Security; and
- Safeguarding Arrangements. Key Findings The audit found that there were good procedures in place for financial management and governance at the school. However recommendations were made in a number of areas. The register of interests for Governors and published policies should be updated on the schools website. Published policies should include the Information Commissioners model Publication Scheme and Guide to Information. A register of interests should be maintained for staff with financial responsibilities. All procurement should be completed in accordance with the Council’s Contract Rules. The school should take care to ensure that VAT is only reclaimed where a VAT invoice or receipt is in place. A cheque log should be maintained to ensure all cheque stationery is accounted for. Financial Monitoring reports issued to Governors using data manually extracted from the Finance System should be accompanied by a system report to confirm the accuracy of extracted balances and a full record of discussions relating to the presented monitoring report should be maintained and referred to in the Finance Committee minutes. Controls should be in place to ensure an annual check of departmental inventories has been completed and all inventory records should be held in a secure location.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Register of Interests

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| | The school does not have a current register of interests in place for staff with financial responsibilities. The register of interests for Governors published on the schools website was neither complete nor up to date. | The requirements of the Constitution of Governing Bodies Statutory Guidance 2015 in relation to transparency are not being met and the school may not be able to fully justify purchasing decisions in the event of challenge. |

Findings

Governors and members of staff with financial responsibilities may be in a position to influence the placing of contracts in which they have a personal interest and must therefore ensure that all significant interests are declared. A register of interests must be maintained and reviewed on an annual basis. The school’s purchasing procedures should ensure that any officer declaring a relevant interest is not involved in the purchasing decision.

In the interests of transparency, and in accordance with statutory guidance the governing body is required to publish on its website up-to-date details of its register of interests and other governance arrangements.

A register of interests for staff was found at the school but had not been kept up to date. A current register of interests for Governors was in place, however the register had not been updated on the schools website.

Recommendation

The school should ensure that all staff with financial responsibilities, in particular those who can sign orders and influence purchasing decisions, sign a declaration of interests on an annual basis. At minimum this register should cover all budget holders and members of the senior leadership team who may be able to influence purchasing decisions. The register must be renewed annually and officers made aware of the need to declare any relevant interests as they may arise.

The register of interests for Governors should be updated on the school’s website.

Agreed Action 1.1

All Senior Leadership Team members, budget holders and Finance personnel have now signed a declaration of interest which details the examples of conflicts of interest, why each have to declare these interests, each of their responsibilities and the implication for not declaring any interest. Declarations will be renewed at the start of every academic year.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager & Head of Support Services | Complete | 2 School Policies

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school has not adopted a current Publication Scheme and associated Guide to Information. These documents should be published on the school’s website. It was noted that a number of policies published on the school’s website were out of date. | Policies may be out of date and not compliant with current legislation or Governors requirements. The school may not comply fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA). |

Findings

The school’s schedule of policies recorded that a Publication Scheme had been approved in 2012 however a copy was not available at the school and there was no evidence of review. The Information Commissioner specifies that schools must adopt a current model Publication Scheme and Guide to Information and these documents should be made available on the school’s website.

A number of the policies published on the school’s website were out of date. This appeared to be due in some cases to a failure to update after review.

Recommendation

The school should ensure they have adopted the Information Commissioners Model Publication Scheme with the Guide to Information available from the ICO website. The approved scheme and Guide to Information should be published on the schools website and where possible the information referred to in the schedule made available via the website.

The policies on the schools website should be checked to ensure they are the most up to date versions. Where policies are out of date they should be scheduled for review.

Agreed Action 2.1

An adopted Information Commissioners Model Publication Scheme and Guide to Information will be added to the website. The website will give details about general access to information and policies and will eventually hold all the various school policies. Policies on the website will be reviewed on a termly basis to ensure they are up to date.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager & Head of Support Services | 30 April 2017 | 3 Contract Review

| Issue/Control Weakness | Risk | |------------------------|------| | The school has compiled a schedule recording ongoing contractual arrangements. This has not as yet been presented to Governors. | Best value may not be obtained from service contracts at the school. |

Findings

A contract schedule detailing all ongoing contractual arrangements at the school is in place but requires update to include all current contracts. The schedule including contract costs and contract end dates had not been presented to Governors to evidence that the arrangements are reviewed at least annually and that procurements are effectively planned where appropriate.

Recommendation

The schedule of contracts now in place should be presented to Governors Finance Committee on at least an annual basis to evidence review of contractual arrangements and provide assurance to Governors of effective procurement planning.

Agreed Action 3.1

A review is to be completed of current contract records and associated review and renewal dates. The contract schedule, including details of proposed action should the contract renewal in the current financial year, will then be presented to the Governors Finance Committee. This schedule will be presented annually at the start of each financial year or the first Finance Governors Meeting of the financial year.

| Priority | 3 | |----------|---| | Responsible Officer | Business Manager & Head of Support Services | | Timescale | 30 April 2017 |

### 4 Procurement

| Issue/Control Weakness | Risk | |------------------------|------| | A contract had been let without a procurement exercise being completed by the school. | Failure to comply with the Council’s Financial Regulations and Contract Rules. |

#### Findings

Significant purchases from suppliers or contractors were reviewed to ensure procurement procedures were in compliance with the Council’s Financial Regulations and Contract Rules. All appeared compliant with the exception of the purchase of a new Finance System (total cost in the region of 13.5K) which had used the procurement exercise completed by another school to make the procurement decision. The school had not obtained a waiver from Financial Regulations in order for this to proceed.

#### Recommendation

All purchases in excess of £5K should be subject to a quotation or tendering exercise in accordance with the Council’s Contract Rules. If the school proposes not to complete this exercise, the reasons should be notified to the Council as part of an official waiver application. An approved waiver from Financial Regulations should be obtained prior to awarding the contract.

#### Agreed Action 4.1

On a routine basis all procurement is in accordance with City of York Council’s Financial Regulations and Contract Rules. At every Finance Governor Meeting, assurance is given that the correct processes have been followed.

The use of another schools procurement process for the purchase of the new Finance system was agreed by the Head and disclosed to the Governors who agreed that it was an efficient practice and no objections were made. Should this happen again the school will apply for a CYC waiver.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager & Head of Support Services | Complete |

### 5 VAT

| Issue/Control Weakness | Risk | |------------------------|------| | On occasions VAT had been reclaimed for on-line purchases when a VAT receipt or VAT invoice had not been obtained. | Penalties may be levied by H M Revenue & Customs for failure to account correctly for VAT. |

#### Findings

Testing of purchases made using the schools purchasing card highlighted that on occasions, the VAT element of the purchase had been reclaimed without a VAT receipt or VAT invoice being obtained. The cases identified related to on-line purchases.

#### Recommendation

A VAT receipt or VAT invoice must be in place before VAT is reclaimed for expenditure at the school.

#### Agreed Action 5.1

The school will ensure that all VAT reimbursements are supported by valid VAT invoices or receipts which have been checked to ensure they record all the required details.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager & Head of Support Services | Complete |

### 6 Cheque Log

| Issue/Control Weakness | Risk | |------------------------|------| | The school uses pre-printed stationery to print cheques but does not maintain a cheque control log. | Cheques may not be fully accounted for. Unauthorised payments may be made. |

#### Findings

When a cheque run is completed there is currently no evidence of independent confirmation that all cheques have been accounted for in sequence from the last cheque run.

#### Recommendation

It is recommended that a cheque log is completed for each cheque run, recording the date of the run, the first and last cheque number, the number of cheques used and any cancelled or spoilt cheques (which should be marked cancelled and retained). This should be signed by the officer completing the cheque run and a verifying officer after confirming all cheques are accounted for. A pro-forma cheque log has been sent to the school.

#### Agreed Action 6.1

A record of cheques was being retained, however a process is now in place whereby a strict log is kept which is checked and signed by the SLT cheque signatory to evidence that all cheques have been accounted for.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager & Head of Support Services | Complete | 7 Financial Management

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The financial monitoring report presented to Governors is compiled by extracting data from the finance system. As such, errors may occur in the figures presented to Governors. Additionally some issues relating to the information presented are discussed by e-mail prior to the meeting and this may not be recorded in the Committee minutes. | Financial decisions may be based on incorrect data and may adversely affect the budgetary position at the school. |

Findings

Budget monitoring reports are currently being produced in a format preferred by the Governors rather than directly from the Finance System. It was confirmed that the start budget and revised budget had been correctly entered onto the reports presented to Governors. Actual income and expenditure recorded on the Governors monitoring reports appeared to be reasonable compared to that recorded on the Finance System but could not be easily matched unless a report is produced at the time of transfer. It was noted that at the time of the audit there appeared to be some minor discrepancies in the budgets recorded on the finance system compared to the Governor approved budgets.

The school continues to raise manual orders rather than using the Civica Purchasing electronic ordering system. Commitments at the school are therefore not recorded. It is understood that a new Finance and purchasing system has been procured and will be implemented shortly which should address this issue.

It was advised by the School Business Manger that after committee papers have been sent out, but prior to the Finance Committee meetings, a number of queries relating to the financial monitoring may be raised by committee members and resolved by e-mail. These are not recorded in the minutes or necessarily made available to all committee members. The minutes of the meeting and associated papers may therefore not be a full record of discussions taking place.

Recommendation

If Governors continue to require monitoring reports produced by manual extraction of balances from the Finance System it is recommended that a monitoring report produced directly from the Finance System is included in the committee papers to confirm that balances have been accurately transferred.

It is recommended that any issues addressed via e-mail prior to a Finance Committee meeting being held are referred to in the minutes and copies of the relevant e-mails made available to all committee members. | Agreed Action 7.1 | |-------------------| | It is acknowledged that it would provide the Governors with an extra level of confidence to ensure that any monitoring reports produced by the Finance Team match the data our finance system holds. | | For the last two meetings, any pre-meeting discussions between a Governor and the School about the finance data have been copied to all Finance Governors and the Clerk to the Governors for these discussions to be added to the overall minute records. |

| Priority | 3 | |----------|---| | Responsible Officer | Business Manager & Head of Support Services | | Timescale | 31 March 2017 | 8 Inventory

| Issue/Control Weakness | Risk | |------------------------|------| | There is no control in place to ensure that inventory records for all departments are independently checked on an annual basis. Paper records are not held in a fire and flood proof location. | Items which have been lost or misappropriated may not be identified and investigated. |

Findings

Each department maintains their own inventory record. There is no central record maintained to confirm that an independent check of the inventory records has been completed.

Some inventory records are in a paper format. These are not being held in a fire or flood proof location.

Recommendation

Departmental inventory records should be checked annually by an officer independent of maintaining the record. It is suggested that departments are reminded to complete this check and a central record maintained recording the date of the check and the name of the checking officer. For electronic inventory records an electronic copy of the last verified inventory should be retained or the main inventory record annotated to evidence the check. If a targeted check only has been completed eg of particular equipment or higher value items this should be highlighted on the record.

Inventory records which are maintained in a paper format should be held in a fire and flood proof location. It is suggested that these are held centrally.

Agreed Action 8.1

A procedure has been agreed whereby departmental inventories will be submitted annually for a central independent check. The check will be evidenced and the results reported to Governors.

The inventory records will be held electronically for safety.

| Priority | 3 | |----------|---| | Responsible Officer | Business Manager & Head of Support Services | | Timescale | 30 April 2017 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.